Commy Virus

Virus Name: Commy Aliases: V Status: Rare Discovery: December, 1992 Symptoms: .COM file growth; file date/time seconds changed Origin: USSR Eff Length: 998 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, Sweep, F-Prot, ViruScan, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Commy virus was submitted in December, 1992. It is originally from the USSR. Commy is a non-resident, direct action infector of .COM programs, including COMMAND.COM. It only replicates after 9PM (21:00). When a program infected with the Commy virus is executed, the virus will check the system time. If the system time is before 9PM, the virus will pass control to the host program and not replicate. If The system time is 9PM or later, the virus may infect one .COM program located in the current directory before passing control to the host program. Programs infected with the Commy virus will have a file length increase of 998 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to 44, 46, 60, or 62. The following text strings are encrypted within the viral code in all Commy infected programs: "The DIRTY COMMY said .." "*.COM A*.EXE" "PATH=" It is unknown what Commy does besides replicate.